4 ms·
CloudTrail is indeed very cheap for customers — we record nearly all API calls and access to AWS resources and deliver these events to our subscribing customers
by mcqueenjordan 9y ago
CloudTrail is indeed very cheap for customers — we record nearly all API calls and access to AWS resources and deliver these events to our subscribing customers. And the events are delivered for free, outside of S3 and Lambda “Data events” — gets, puts, and function invocation is billed at a very cheap rate.
(We recently released our AWS Lambda integration — you can now record all Lambda function invocations with us!)
Disclaimer: I’m a Software Engineer with the AWS CloudTrail team.
- tptacek 9y agoIf I'm reading this right, you now have two paid services for detecting CT anomalies: Guard Duty, which is nosebleed expensive, and Macie, which is practically free. What's the difference between the two?
- p0rkbelly 9y agoMacie Analayzes a subset of CloudTrail, not all actions and is about historical behavior (though for high sev actions, it is more point in time) GuardDuty is looking for specific threats/attacks and can combine multiple sources of telemetry for more advanced correlation. E.g. A combination of VPC Flows + CloudTrail + DNS that trigger an alert when formed together while a single CloudTrail event may not have.
- tptacek 9y agoWithin CT, what are examples of things Macie will catch, vs. things you'd need GD to catch? If GD weren't so expensive, I wouldn't really care that much. But GD is so expensive that it can be hard to recommend, which is especially weird since the pricing for Macie CT is so low --- even weirder when you note that the pricing for Macie S3 is so high!
- p0rkbelly 9y agoI found the pricing for Guard Duty reasonable compared to most IDS systems. They let you turn on GuardDuty for free for 30 days and give you an estimate your bill so that helps.